Dashboards & Visualizations

How to not include LD_PRELOAD in Error Alerts?

aditsss
Motivator

Hi All,

I have created Alerts on the basis of Error keyword . Below is one of my alert

index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR"|rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"|eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")| cluster showcount=t t=0.4|table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns |dedup Error_Message| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count

On the basis of above query I am getting one of the Error message as shown below:

message = ERROR: ld.so: object 'libnss_wrapper.so' from LD_PRELOAD cannot be preloaded: ignored.

I want Error message with LD_PRELOAD should not come in Alerts.

Can someone guide me what should I change in my alerts

 

 

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Just like you have an exclusion for "INTERNAL_SERVER_ERROR", add a similar exclusion for "LD_PRELOAD".

index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR" NOT "LD_PRELOAD"
| rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"
| eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")
| cluster showcount=t t=0.4
| table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns | dedup Error_Message
| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Just like you have an exclusion for "INTERNAL_SERVER_ERROR", add a similar exclusion for "LD_PRELOAD".

index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR" NOT "LD_PRELOAD"
| rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"
| eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")
| cluster showcount=t t=0.4
| table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns | dedup Error_Message
| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...